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CHAPTER    I 
INTRODUCTION 

During  late  1982,  the  Office  of  the  Legislative  Auditor 
conducted  a  survey  of  state  data  processing  activities.  One  of  the 
potential  audit  areas  included  in  the  survey  was  the  coordination 
and  control  of  state  data  processing  activities.  The  Legislative 
Audit  Committee  requested  an  audit  covering  this  issue.  This 
report  is  a  result  of  our  audit. 
ORGANIZATION    OF    REPORT 

This  report  is  presented  in  five  chapters.  Chapter  I  presents 
an  introduction  to  the  report  and  summarizes  the  objectives  and 
scope  of  our  audit. 

Chapter  II  presents  background  information  on  the  coordina- 
tion and  control  of  state  data  processing.  Also  discussed  is  the 
law  passed  by  the  1983  Legislature  transferring  the  control  function 
from  the  Office  of  Budget  and  Program  Planning  to  the  Department 
of  Administration.  The  chapter  recommends  a  more  active  leadership 
role  for  the  coordination   and   control   function. 

Chapter    III     examines    current    data     processing     planning     and 
includes   recommendations  to   improve  the  usefulness  of  data  process- 
ing  planning. 

Chapter  IV  discusses  statewide  policies  and  procedures  related 
to    data    processing,    including   several    suggestions   for   improvement. 

Chapter  V  concerns  other  data  processing  management  areas 
relating  to  inventory  of  computer  programs  and  management  of  data 
processing    professional    staff. 


ISSUES    FOR    FURTHER   STUDY 

During  our   review,    we   identified  five   issues  for  future  study. 
These   include: 

--computer   program  maintenance; 

--central   computer  workload; 

--accuracy    of    computer    program    development    cost    projections; 

--Computer  Services   Division    (CSD)   funding; 

--exemptions  to  controls. 

The  Office  of  the  Legislative  Auditor  will  perform  audits 
addressing  these  five  issues.  An  upcoming  audit  of  the  System 
Development  Bureau  will  address  such  issues  as  the  accuracy  of 
project  cost  projections,  the  management  of  computer  program 
maintenance,  and  the  funding  of  development  projects.  We  will  be 
auditing  agency  management  of  data  processing,  including  manage- 
ment of  computer  program  maintenance,  management  of  computer 
workload,  accuracy  of  computer  program  development  cost  projec- 
tions, and  agency  controls  over  data  processing.  An  audit  of 
CSD's  billing  and  funding  system  is  also  anticipated. 
MANAGEMENT   MEMORANDUM 

As  a  result  of  this  audit,  we  issued  a  management  memo- 
randum. (Management  memoranda  are  communications  to  agency 
management  concerning  issues  they  may  wish  to  address.)  The 
memorandum  concerned  our  findings  relating  to  the  membership  and 
duties  of  data  processing  steering  committees  and  advisory  councils. 
It  contained  suggestions  for  structuring  the  data  processing 
advisory  council  created  by  the  1983  Legislature.  We  based  the 
suggestions  on  discussions  with  officials  from  other  states  and  from 
private  firms. 
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OBJECTIVES   OF   AUDIT 

The  objectives  of  the  audit  were: 

1.  To  evaluate  the  effectiveness  of  laws,  rules,  policies  and 
procedures   related   to  data   processing. 

2.  To  evaluate  the  adequacy  of  the  state  data  processing 
administrative  structure. 

3.  To  evaluate  the  efficiency  and  effectiveness  of  systems 
used  to  allocate  data  processing   resources. 

4.  To   evaluate   the   utilization   of   data   processing   resources. 

5.  To  evaluate  the  adequacy  of  information  provided  to 
management  and  the  Legislature  concerning  data  process- 
ing  activities. 

6.  To  evaluate  compliance  with  applicable  statutes  and 
policies. 


SCOPE   OF   AUDIT 

The  audit  focused  on  the  adequacy  of  management  controls 
concerning  state  data  processing  and  the  efficiency  and  effective- 
ness of  the  control  function.  The  audit  was  conducted  in  accor- 
dance with  generally  accepted  government  performance  auditing 
standards.  Chapter  11  discusses  agency  compliance  with  applicable 
laws  and  regulations.  For  items  we  did  not  test,  nothing  came  to 
our  attention  to  indicate  substantial   noncompliance. 

As  part  of  our  audit,  we  contacted  nine  states  to  determine 
how  they  controlled  their  data  processing  activities.  These  states 
were  identified  as  being  progressive  and  well  run  by  data  process- 
ing officials  in  Montana  and  by  officials  of  the  National  Association 
of  State  Information  Systems.  We  also  surveyed  five  large  national 
firms  from  different  industries  to  ascertain  how  they  controlled 
their  data   processing   activities. 


We  visited  ten  state  agencies  as  part  of  our  review.  These 
included  four  large  departments,  two  smaller  departments,  two 
elected  officials,  and  two  university  units.  We  interviewed  agency 
officials  to  gather  data  on  agency  operations  and  to  ascertain  staff 
opinions  of  the  current  controls.  We  examined  individual  agency 
data  processing  plans  and  reviewed  documents  to  confirm  our 
interviews . 

We  interviewed  Office  of  Budget  and  Program  Planning  (OBPP) 
and  Department  of  Administration  (DofA)  officials  to  determine 
what  controls  exist  over  state  data  processing  activities  and  what 
coordination  efforts  were  being  undertaken.  Our  review  also 
included: 

--Laws,    rules,    policies,    and    procedures   relating   to  coordination 
and   control   of  data   processing. 

--Planning   documents. 

--Advisory  committee  minutes. 

--A   sample  of  budget   request  justifications. 

--A   sample  of  equipment  acquisition   request  justifications. 

--A   sample  of  potential   data   processing   duplications. 

--A   sample  of  personnel   turnovers. 


CHAPTER    II 
BACKGROUND 

We  estimate  data  processing  expenditures  by  state  agencies 
exceeded  $20  million  for  fiscal  year  1982-83.  (Exact  numbers  are 
not  available  because  some  data  processing  expenditures  are  not 
identifiable    on    the    Statewide    Budgeting    and    Accounting    System.) 

The  Legislature  has  mandated  some  central  control  over  data 
processing  activities.  Prior  to  April  1983,  the  Office  of  Budget 
and  Program  Planning  (OBPP)  had  the  responsibility  for  control. 
The  budget  director  designated  a  staff  member  as  the  data  process- 
ing coordinator.  Initially,  the  coordinator  position  was  almost 
full-time.  A  reorganization  of  OBPP  combined  the  coordinator 
duties  with  those  of  the  deputy  budget  director.  The  reorganiza- 
tion of  functions  caused  OBPP  to  decrease  the  time  spent  on  the 
coordination  function  from  1  FTE  to  .3  FTE.  In  our  opinion,  the 
time  available  to  devote  to  coordination  was  not  sufficient  given  the 
duties   provided   by  the   Legislature. 

The  data  processing  coordinator  originally  was  advised  on 
policy  matters  by  the  Montana  Data  Processing  Advisory  Council 
(MODPAC).  This  group  was  made  up  of  data  processing  profes- 
sionals from  various  agencies  appointed  by  the  budget  director. 
MODPAC  was  disbanded  in  1979.  A  data  processing  managers 
group  advises  the  Computer  Services  Division  of  DofA  on  technical 
matters. 

The  1983  Legislature  transferred  the  coordination  and  control 
responsibility  for  data  processing  from  OBPP  to  the  Department  of 
Administration    and    provided   for  an   advisory  council.      The  director 


of    DofA    will    appoint   the    council    to   give    advice  on   data   processing 

policy  matters. 

COMPLIANCE 

We  conducted  our  audit  during   early  1983.      During   our   review, 
the     Legislature     changed     the     responsibility    for    coordination     and 
control.       We    evaluated    compliance    with    the    previous    statutes    and 
planned   implementation  of  the  new   law.      We  also   reviewed   compliance 
with   policies  drafted   pursuant  to  the  statutes. 

The  budget  director  was  initially  given  most  of  the  responsi- 
bility for  coordinating  and  controlling  data  processing.  The 
Department  of  Administration's  only  legal  responsibility  was  to 
operate  a  central  computer  center.  The  following  briefly  describes 
the  statutes  and  our  evaluation  of  compliance. 


Compliance  with  Statutes 
(Prior   to  April    1983) 


Statute 

18-4-111,  MCA,  the  budget  director 
shall: 

(1)  establish  guidelines  for  the 
operation  and  development  of 
data  processing  services  by 
or  for  state  government; 


(2)  set  priorities  for  develop- 
ment and  acquisition  of  data 
processing  systems; 


Compliance  Comment 


Some  policy  statements  were 
issued  (see  page  9).   State 
plan  not  updated  (see  page  or 
13).   No  policies  issued  for 
planning  (see  page  16), 
software  development  (see 
page  20) ,  or  software  doc- 
umentation (see  page  22). 

Prioritized  central  develop- 
ment projects.   Little  review 
of  development  performed  by 
an  agency's  own  staff.   See 
page  29  for  discussion  of 
justifications . 


Statute 


Compliance  Comment 


(3)  approve  the  procurement  of 
data  processing  equipment 
before  such  equipment  is 
acquired  for  state  govern- 
ment by  the  department  of 
administration; 


(4)  approve  the  addition  of  data 
processing  staff; 


(5)  review  and  approve  all  con- 
tracts for  private  sector 
data  processing  services. 

2-17-301(1),  MCA,  the  depart- 
ment of  administration  shall 
maintain  and  supervise  any  .  . 
data  processing  .  .  .  facili- 
ties for  state  agencies  in  the 
capitol  area. 


Approval  by  the  data  process- 
ing coordinator  was  required 
before  the  request  would  be 
processed  by  DofA.   Documen- 
tation of  the  approval  pro- 
cess was  minimal  (see  page 
10).   Also  see  page  29  for 
discussion  of  justifications. 

No  formal  process.   Informally 
performed  through  the  budget 
process.   See  page  26  for  dis- 
cussion of  justification. 

No  control  mechanism  existed. 
Agencies  were  on  their  honor 
to  submit  contracts. 

DofA  operated  the  central  com- 
puter center  and  provided  com- 
munication capability  between 
agency  offices  and  the  computer 
center. 


We  do  not  make  any  recommendations  concerning  compliance 
with  these  statutes  because  of  the  transfer  of  responsibility  from 
OBPP  to  DofA. 

The  following  indicates  the  provisions  in  the  new  law,  DofA's 
implementation  plan,  and  our  evaluation  of  DofA's  planned  implemen- 
tation. 


Planned  Implementation  of  Statutes 
(After  April  1983) 


Statute 

18-4-111(1),  MCA,  except  as 
provided  in  subsection  (2) ,  the 
director  of  the  department  shall: 

(a)  establish  policies  and  a 
statewide  plan,  in  coopera- 
tion with  state  agencies, 
for  the  operation  and  devel- 
opment of  data  processing 
for  state  government; 

(b)  review  and  approve  agency 
specifications  and  procure- 
ment methods  for  the  acqui- 
sition of  data  processing 
equipment,  excluding  specifi- 
cations and  methods  relating 
to  instruction  and  research 
in  the  university  system,  to 
insure  network  compatability 
and  conformity  with  the  state- 
wide data  processing  plan; 

(c)  review  and  approve  all  con- 
tracts for  private  sector  data 
processing  services  to  insure 
conformance  with  the  state- 
wide data  processing  plan; 

(d)  operate  and  maintain  a  central 
computer  center  and  a  data 
processing  equipment  pool  for 
the  use  of  all  state  agencies 
and  political  subdivisions. 

(2)   The  responsibilities  of  the 
director  under  this  section 
do  not  apply  to  the  office  of 
the  superintendent  of  public 
instruction  and  that  office  is 
exempt  from  the  requirements 
of  this  section. 


Planned  Implementation 


DofA  has  started  work  on  a 
statewide  plan.   Development 
of  policies  is  also  begin- 
ning.  See  pages  20  to  31 
for  our  suggestions. 


DofA  has  begun  reviewing 
equipment  requests.   We 
will  review  the  university 
system's  procedures  for  con- 
trolling instruction  and 
research  equipment  purchases 
in  future  audits. 


DofA  has  started  to  review 
contracts  submitted  to  them. 
No  mechanism  exists  to  assure 
all  contracts  are  reviewed. 


DofA  continues  to  operate 
the  central  computer.   The 
equipment  pool  is  planned 
for  later  this  year. 


We  will  review  the  control 
procedures  instituted  by  the 
Office  of  the  Superintendent 
of  Public  Instruction  in  a 
future  audit. 


Statute 


Planned  Implementation 


New  Section 

(1)  The  department  shall  create  a 
state  data  processing  advisory 
council  under  2-15-122,  MCA. 

(2)  The  members  of  the  advisory 
council  shall  be  selected 
from  a  diverse  group  in  order 
to  adequately  represent  the 
interest  of  state  agencies, 
including  the  university 
system. 


DofA  is  in  the  process  of 
establishing  the  council. 


DofA  plans  to  appoint  top 
managers  from  various 
agencies . 


DofA  officials  state  they  are  working  toward  compliance  with 
the  new  statutes. 

The  third  area  we  evaluated  was  data  processing  policies. 
Those  policies  were  drafted  by  the  former  data  processing  coordina- 
tor.  The  following  describes  each  policy  and  our  evaluation  of 
compliance. 


Compliance  with  Policy  Statements 
Policy  Statement  Compliance  Comment 

-Contracted  Services  - 


required  agencies  to  con- 
tract with  Information  Sys- 
tem Division  (now  Systems 
Development  Bureau)  if 
possible ; 

outlined  procedures  for 
requesting  quotations; 

supplied  a  standard 
contract  form. 


No  mechanism  established 
to  assure  compliance. 


No  mechanism  established 
to  assure  compliance. 

No  mechanism  established 
to  assure  compliance. 


Policy  Statement 


Compliance  Comment 


-Required  agencies  to  justify 
equipment  acquisition  request. 


-Required  justification  of  word 
processing  equipment  requests 
and  required  equipment  to  be 
compatible  with  cental  computer. 


-Required  agencies  to  get  OBPP's 
approval  before  releasing  computer 
programs  to  private  sector  firms. 

-Outlined  circumstances  under  which 
private  firms  may  use  state  data 
processing  equipment. 

-Noted  that  there  is  a  statewide 
data  processing  plan. 

-Required  approval  of  OBPP  before 
disposing  of  data  processing 
equipment. 

-Required  CSD  to  develop  a  dis- 
aster recovery  plan  for  the 
central  computer  facility. 
Made  users  responsible  for 
developing  their  own  disaster 
recovery  plans. 


-Allowed  agencies  to  share  soft- 
ware.  Set  up  a  system  at  CSD 
whereby  agencies  can  submit 
computer  programs  which  other 
agencies  might  use. 


DofA  Purchasing  assures 
that  all  requests  have 
been  approved.   Justifi- 
cations are  discussed  on 
page  29. 

DofA  Purchasing  assures 
that  all  requests  have 
been  approved.   Justifi- 
cations are  discussed  on 
page  29. 

No  mechanism  established 
to  assure  compliance. 


No  mechanism  established 
to  assure  compliance. 


See  page  13  for  comments 
about  the  plan. 

OBPP's  review  of  new 
equipment  requests  kept 
it  informed  of  disposals. 

CSD  has  developed  a  plan 
which  has  some  weaknesses. 
An  upcoming  EDP  audit 
report  will  discuss  the 
CSD  weaknesses  in  more 
detail.   Agency  disaster 
plans  are  generally  weak. 
Separate  audits  of  each 
agency  will  address  the 
weaknesses . 

CSD  has  not  received  much 
of  a  response.   See  page 
33  for  more  comments  on 
sharing  computer  programs. 


Although  these  policies  were  established,  there  was  no  mechan- 
ism to  assure  agency  compliance  and  agencies  were  on  an  honor 
system  with  respect  to  compliance.   Therefore,  we  cannot  be  sure 
that  the  policies  were  being  followed.   One  exception  is  the  software 
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inventory    policy    which    has    not    been    implemented.      This    situation 

is    discussed    further   on    page  33.       DofA    may    wish    to    update   these 

policies    now   that   they    have    the    responsibility    for    controlling    data 

processing. 

ROLE   OF   THE   COORDINATION    AND   CONTROL    FUNCTION 

Our  review  indicated  OBPP  was  not  active  in  coordinating  and 
controlling  data  processing.  Some  memoranda  were  issued  but  few 
controls  existed  to  assure  compliance.  The  OBPP  data  processing 
coordinator  reviewed  equipment  requests.  However,  the  documenta- 
tion of  the  review  was  so  limited  that  we  were  unable  to  verify  the 
extent  of  the   reviews. 

The  Computer  Services  Division  of  DofA  also  does  not  appear 
to  have  taken  an  active  role  in  coordination  and  control.  CSD's 
actions  and  our  interviews  with  various  officials  indicate  that  CSD 
acted  primarily  as  a  service  organization.  The  approach  taken  by 
OBPP  and  DofA  was  that  each  agency  would  be  responsible  for  its 
own     data     processing    with    little    central    coordination    and    control. 

Examples  of  the   lack  of  active  central   direction   include: 


--No    update   or   evaluation   of  the   state   data   processing    plan    in 
five  years. 

--No     policies     issued     for    or    review    performed    on    agency    data 
processing   plans. 

--No    policies    for    computer    program    development   or    documenta- 
tion . 

--Poor  justification  of  budget   requests  and   equipment  acquisition 
requests. 


Chapter  486,  Laws  of  1983,  gave  DofA  broad  powers  to  estab- 
lish policies  and  to  prepare  plans.  The  state  can  avoid  the  recur- 
rence   of    many    of   the    problems    noted    later    in    this    report    if    DofA 
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takes    an    active    leadership   role   in   coordinating   and   controlling   data 
processing   activities. 

RECOMMENDATION    #1 

WE      RECOMMEND      THE      DEPARTMENT     OF      ADMINISTRATION 

USE     ITS     AUTHORITY     AND     TAKE     AN     ACTIVE     LEADERSHIP 

ROLE     IN     COORDINATING     AND     CONTROLLING     STATE    DATA 

PROCESSING. 


12 


CHAPTER  III 
PLANNING 
Planning  is  an  important  step  in  establishing  adequate  manage- 
ment controls.  From  the  information  gathered  in  our  data  process- 
ing survey,  we  believed  there  were  significant  weaknesses  in  the 
state's  data  processing  planning.  We  reviewed  the  state's  overall 
plan  plus  the  data  processing  plans  of  a  sample  of  agencies.  We 
also  gathered  information  from  a  sample  of  other  states  and  private 
firms  and  compared  their  plans  and  planning  procedures  to 
Montana's. 

Our    analysis    indicated    that    five    significant   weaknesses   exist 
in     Montana's     data     processing     planning.       The    following     sections 
discuss   the   state  plan   and   the  agency   plans. 
STATE   PLAN 

The  Montana  Long  Range  Information  Processing  Plan  was 
published  in  1978  and  included  descriptions  of  the  various  agency 
data  processing  activities  as  well  as  the  activities  of  the  central 
computer  center.  It  also  included  goals  and  objectives  for  state 
data  processing.  Our  analysis  indicates  that  the  lack  of  updating 
the  plan  and  the  lack  of  evaluation  of  goals  and  objectives  achieve- 
ment are  two  major  weaknesses. 
Updating 

We  found  that  the  state  plan  has  not  been  updated  since  its 
release.  The  executive  summary  of  the  plan  stated  the  plan  was 
to   be  updated  on   a   biennial    basis. 

There  may  have  been  some  confusion  concerning  who  was 
responsible     for     updating     the    plan.       The    Office    of    Budget    and 
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Program   Planning   had   the  statutory  coordination   and   control    respon- 
sibility.     Usually  the  coordination   and   control    responsibility   includes 
planning.       However,    the    state    plan    gave    the    responsibility    to    the 
Department   of   Administration.       DofA's  only   statutory   responsibility 
was  to  operate  a  computer  center. 

The  actions  of  the  1983  Legislature  have  clarified  the  planning 
responsibilities.  Chapter  486,  Laws  of  1983,  slates  the  Director  of 
the  Department  of  Administration  shall  "establish  a  statewide  plan 
in  cooperation  with  state  agencies,  for  the  operation  and  develop- 
ment of  data   processing   for  state  government." 

The  state  plan  is  not  an  accurate  reflection  of  data  processing 
in  state  government  at  this  time.  For  example,  the  state  plan  does 
not  mention  that  the  Department  of  State  Lands  intends  to  create  a 
major  state  land  data  base.  Also  the  topic  of  microcomputers, 
which  are  beginning  to  be  used  extensively  in  state  government,  is 
not  addressed. 

A  plan  should  be  updated  periodically  so  it  is  accurate  and 
thus  useful  to  management  and  the  Legislature.  Our  contacts  with 
other  states  and  private  firms  indicate  they  update  their  plans  on 
either  an   annual   or  biennial    basis. 

We  believe  the  Legislature  and  the  top  agency  managers 
should  have  a  current  document  explaining  the  status  of,  and  the 
future  of  data  processing  to  use  in  making  decisions.  There  is 
little  assurance  the  plan  will  stay  current  without  some  policy 
concerning  the  frequency  of  update.  Therefore,  we  recommend 
the  Department  of  Administration  establish  a  policy  for  updating 
the    state    plan    on    a    biennial    basis.       A    biennial    update    would    be 
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most    appropriate    because    it    would    coincide    with    the    budget    cycle 
and  the   Legislative  session. 

Evaluation  of  Goals  and   Objectives  Attainment 

An  important  follow-up  process  to  data  processing  planning  is 
evaluating  the  attainment  of  goals  and  objectives  of  a  data  process- 
ing plan.  We  found  no  documentation  of  evaluation  of  attainment 
of  goals  and  objectives  for  the  state  plan  since  the  state  plan  was 
developed   almost  five  years  ago. 

The  companies  and  states  we  contacted  perform  periodic 
evaluations  of  the  attainment  of  their  planned  goals  and  objectives. 
We  believe  a  review  process  is  necessary  in  order  for  the  state  to 
evaluate  where  it  is  in  relation  to  its  plans.  Without  the  review, 
managers  are  unsure  how  close  they  are  to  attaining  their  goals 
and  objectives.  Information  on  goals  and  objectives  attainment 
could  also  be  useful  to  the  Legislature  in  determining  what  funds 
to  appropriate  for  data   processing. 

We  recommend  the  Department  of  Administration  review  goal 
and  objective  attainment  of  the  state  plan  on  a  biennial  basis. 
Again  a  biennial  time  frame  was  chosen  to  coincide  with  the  budget 
cycle  and   the   Legislative  session. 

RECOMMENDATION    #2 

WE      RECOMMEND     THE     DEPARTMENT     OF     ADMINISTRATION: 

A.  ESTABLISH  A  POLICY  FOR  UPDATE  OF  THE  STATE 
PLAN    ON    A    BIENNIAL    BASIS. 

B.  REVIEW  ATTAINMENT  OF  GOALS  AND  OBJECTIVES 
CONTAINED  IN  THE  STATE  PLAN  ON  A  BIENNIAL 
BASIS. 
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AGENCY    PLANS 

A  second  area  we  examined  was  the  adequacy  of  agency 
plans.  The  following  illustration  lists  for  a  sample  of  agencies  the 
fiscal  1982-83  expenditures  for  data  processing  recorded  on  the 
Statwide  Budgeting  and  Accounting  System,  the  status  of  an 
agency   plan,    and  our  evaluation  of  the  plan   if   it  exists. 


AGENCY  PLANNING 


Agency 

Expenditures 
(1982-83) 

SRS 

$2,099,814 

Highways 

2,078,424 

UofM 

1,640,990 

Montana  Tech 

1,029,051 

State  Lands 

141,163 

Justice 

1,117,005 

Commerce 

280,893 

DNRC 

367,128 

OSPI 

85,172 

FW&P 

477,080 

Procedure   for  Hardware 

Achievement   Accomplising   Responsibility   /Software 
Milestones     Objectives    fur  Objectives   Inventory 


Budget       1 
Staffing      Implications   of 
nd  Training   Further  Activities 


Source:   Compiled  by  the  Office  of  the  Legislative  Auditor 


Illustration  1 


Guidelines  for  Agency   Plans 

We  found  only  three  of  ten  Montana  agencies  had  developed 
agency  plans  and  two  others  had  a  plan  in  draft  form.  The  follow- 
ing areas  were  either  not  addressed  or  were  deficient  in  each  of 
the  plans: 
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--Description  of  how  objectives  will    be  obtained. 

--Definition  of  responsibility  for  attaining  objectives. 

--Quantifiability  of  some  objectives. 

--Milestones  for  attainment  of  objectives. 

--Inventories  of  major  equipment  and   software. 

--Training   goals. 

--Staffing   summary. 

--Budget   implications  of  goals  and  objectives. 

These  deficiencies  indicate  that  agencies  are  not  aware  of 
what  items  a  plan  should  address.  This  is  primarily  due  to  the 
fact  that  there  are  no  statewide  guidelines  for  agencies  to  use  in 
preparing  their  plans.  Therefore,  the  plans  prepared  by  the 
agencies   are   incomplete. 

Without  well  developed  agency  plans,  senior  management  and 
the  Legislature  have  inadequate  information  concerning  the  direction 
agencies  are  taking.  Also,  it  is  difficult  to  evaluate  actual  agency 
performance  without  the  criteria  which   plans   provide. 

DofA    has    overall    statutory    responsibility    for    data    processing 
planning    in    the    statutes.       Since    DofA    intends    to    use    the    agency 
plans    as    a    basis    for    the    state    plan,    we    recommend    DofA    establish 
guidelines   for   agency   plans. 
Review  of  Agency   Plans 

Along  with  the  guidelines,  there  should  be  a  review  mechanism 
to  assess  conformance  with  the  guidelines.  The  review  can  serve 
several   useful   purposes: 
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■-It  can  assure  agency  management  that  they  have  a  quality 
document  to  use   in   making   decisions. 

■-Since  agency  plans  are  to  be  used  as  source  materials  for  a 
state  plan,  adequate  agency  plans  will  make  preparation  of 
the  state  plan  easier. 

■-It  can  assure  outside  parties  that  they  have  adequate  informa- 
tion   to    evaluate    budget    requests    for    equipment   and   software. 

■-It  can  provide  a  basis  for  evaluating  data  processing  equip- 
ment requests. 


Currently,  agencies  do  not  receive  any  feedback  concerning 
the  adequacy  of  their  plans.  Consequently,  agencies  do  not  know 
what  weaknesses  exist  in  their  plans  and  so  they  cannot  be  expected 
to  improve  them.  We  recommend  the  Department  of  Administration 
establish  a  process  for  reviewing  agency  data  processing  plans  and 
providing   feedback  to  agency  management. 

Evaluation  of  Goals  and   Objectives   Attainment 

Evaluation  of  goals  and  objectives  attainment  relating  to  the 
state  plan  would  provide  needed  information  to  management  and  to 
the  Legislature.  The  same  is  true  for  the  agency  plans.  The 
evaluation  of  attainment  would: 

--Provide  agency  managers  with   needed   information  on  operations. 

--Provide    the    Department    of   Administration    with    information    to 
evaluate   attainment   of   goals    and    objectives    in    the    state   plan. 

--Provide     the     Legislature     with     information     for     use     when     it 
appropriates  funds. 

Thus,  we  recommend  the  Department  of  Administration  encour- 
age agencies  to  periodically  evaluate  the  attainment  of  goals  and 
objectives  contained   in   agency  plans. 
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RECOMMENDATION   #3 

WE     RECOMMEND     THE     DEPARTMENT     OF     ADMINISTRATION: 

A.  PREPARE  GUIDELINES  FOR  WHAT  CONSTITUTES  AN 
ADEQUATE   AGENCY    DATA    PROCESSING   PLAN. 

B.  ESTABLISH  A  PROCESS  FOR  REVIEWING  AGENCY  DATA 
PROCESSING  PLANS  AND  FOR  PROVIDING  FEEDBACK 
TO   AGENCY   MANAGEMENT. 

C.  ENCOURAGE  AGENCIES  TO  PERIODICALLY  EVALUATE 
THE  ATTAINMENT  OF  GOALS  AND  OBJECTIVES  CON- 
TAINED   IN    AGENCY    PLANS. 
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CHAPTER    IV 
DATA    PROCESSING   POLICIES 

The  OBPP  data  processing  coordinator  issued  several  memo- 
randums establishing  statewide  data  processing  policies.  While 
these  policies  address  some  important  issues,  the  following  sections 
discuss  four  additional  areas  in  which  policies  would  be  useful. 
These  areas  include  computer  program  development,  computer 
program  documentation,  agency  notification  to  CSD  concerning 
resource  needs,  and  justification  of  data  processing  requests. 
COMPUTER    PROGRAM    DEVELOPMENT 

We    found    there    is    substantial    variation    between    agencies    in 
the  management  controls   used   when  computer  programs   are  developed, 
(Computer    programs    are    instructions    which    tell    the    computer  what 
to  do.)      Current  agency   standards,    if  they  exist,    do  not  adequately 
address   such   items   as: 

1.  cost  benefit  analyses; 

2.  analyses  of  alternatives; 

3.  disaster  backup  and  recovery  for  an  application  (an 
application  is  a  set  of  computer  programs  which  perform 
a  task); 

4.  user  participation  in  development  and  testing  of  the  final 
product;    and 

5.  decision   points  for  continuation  or  termination  of  projects. 

Without  good,  consistent  controls  agencies  may  be  spending 
more  developing  computer  programs  than  necessary  or  may  not  be 
developing  adequate  computer  programs.  This  is  important  since 
the  state  spends  in  excess  of  $2  million  per  year  on  computer 
program  development.      Potential   problems   include: 
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--An    agency    developing    computer    programs    which    are    already 
available  from  another  source. 

--The    extra    cost    associated    with    instituting    controls    after    the 
computer  programs  are  developed. 

--The     risk    of    disruption    of    services    if    adequate    backup    and 
disaster   recovery  does   not  exist. 

--The    continued    development    of    computer    programs    after    it    is 
determined   that  another  type  of  computer   program  or   reversion 
to  a  manual    system  would   be   less  costly. 

--The    delivery    of    computer    programs    to    the    user    which    either 
does    not    meet    the    user's    needs    or    the    user    refuses    to    use. 


Policies  could  also  provide  more  effective  control  of  computer 
program  development.  Managers  could  use  the  policies  to  determine 
that  proper  procedures  are  being  followed  and  to  give  assurance 
that  quality  computer  programs  are  being  developed.  The  policies 
can  also  be  used  as  criteria  against  which  to  audit  and  the  Legis- 
lature can  have  assurance  that  computer  program  development 
funds  are  being   spent  wisely. 

There  are  no  statewide  policies  for  state  agency  computer 
program  development.  One  of  the  states  we  contacted,  Oregon, 
has  developed  an  excellent  summary  of  policies  for  agencies. 
Their  summary  document,  Project  Enable,  provides  a  flexible 
framework  for  computer  program  development.  Within  the  frame- 
work, agencies  are  allowed  to  develop  the  most  appropriate  controls 
for  their  operations. 

We  recommend  DofA  develop  a  set  of  general  policies  for 
computer    program    development.       We    believe    general    policies    will: 

--help  assure  development  controls  are  adequate; 
--establish   consistency   between   agencies;    and 
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--minimize     training     time     when     DP     personnel     switch     between 
agencies   (as   is  often   done). 


If  the  state  sets  general  policies,  then  agencies  can  tailor  the 
actual    process  to  meet  their  needs. 

RECOMMENDATION   #4 

WE      RECOMMEND      THE      DEPARTMENT     OF     ADMINISTRATION 

DEVELOP      GENERAL      POLICIES      FOR      COMPUTER      PROGRAM 

DEVELOPMENT. 

COMPUTER    PROGRAM   DOCUMENTATION 

We  found  agency  documentation  of  computer  programs  varies. 
Some  agencies  have  good  standards  and  follow  the  standards  while 
others  have  no  standards  and  their  documentation  is  deficient. 
Also,  documentation  sometimes  is  not  a  high  priority  item  during 
development  causing   the  documentation   to  be  weak. 

Adequate  documentation  is  important  to  the  design  and  imple- 
mentation of  a  well  controlled  system  since  it  provides  the  basis 
for  management  review  of  the  development  process.  The  documen- 
tation also  provides  the  basis  for  a  new  person  to  take  over  a 
project  with  minimal  difficulty  if  one  of  the  original  development 
staff   leave. 

Documentation  standards  should  apply  to  both  internally  and 
externally  developed  computer  programs.  Internally  developed 
computer  programs  require  good  documentation  because  the  person 
maintaining  the  system  will  often  not  be  the  one  who  developed  it. 
Externally  developed  computer  programs  also  require  good  documen- 
tation  because: 
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--The   vendor    may    develop    computer  programs  for  the  state  and 
the  state  may  agree  to  maintain  the  programs. 

--A     vendor     may     discontinue     support    for    computer    programs 
forcing  the   state  to  assume  maintenance. 

--A    vendor    may    go   out   of    business    forcing   the  state  to  assume 
maintenance. 


With  current  maintenance  costs  running  at  about  $2  million  per 
year,  it  is  important  to  minimize  maintenance  difficulties  wherever 
possible. 

Besides  maintenance  advantages,  the  state  can  save  money  by 
having  agencies  share  all  or  parts  of  already  developed  software. 
However,    this    is   only    practical    if  the  software   is  well   documented. 

An  example  of  computer  programs  with  weak  documentation 
during  development  is  the  Statewide  Budgeting  and  Accounting 
System.  Development  of  SB  AS  was  a  cooperative  effort  between 
the  state  and  a  consultant.  The  result  is  a  system  which  appears 
to  run  well.  However,  determining  what  some  computer  programs 
do  and  how  they  interrelate  is  difficult.  Thus,  maintaining  the 
system  is  not  easy.  The  Systems  Development  Bureau,  a  part  of 
Computer  Services  Division,  maintains  SBAS  and  has  been  document- 
ing modules  as  changes  are  made.  This  after-the-fact  documenta- 
tion is  much  more  costly  than  documenting  the  computer  programs 
during   development. 

In  the  case  of  existing  computer  programs,  documentation  as 
maintenance  is  performed  is  the  only  practical  approach.  A  large 
project  to  document  existing  computer  programs  would  be  extremely 
costly  and  probably  not  justified  because  of  the  limited  life  of  com- 
puter programs.  However,  new  programs  should  be  documented  as 
they  are  created. 
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No  statewide  policies  exist  for  documentation.  Such  policies 
would  help  assure  adequate  documentation  of  the  states  computer 
programs.  Since  DofA  has  the  authority  to  establish  statewide 
policies,  we  recommend  DofA  establish  policies  for  documentation  of 
in-house  developed  or  purchased   computer  programs. 

RECOMMENDATION   #5 

WE  RECOMMEND  THE  DEPARTMENT  OF  ADMINISTRATION 
ESTABLISH  POLICIES  FOR  DOCUMENTATION  OF  IN-HOUSE 
DEVELOPED    OR    PURCHASED    COMPUTER    PROGRAMS. 

AGENCY    NOTIFICATION   TO   CSD   CONCERNING    RESOURCE   NEEDS 

Most  agencies  have  their  own  personnel  for  computer  program 
development  while  relying  on  CSD  to  provide  some  or  all  of  their 
computer  processing  capability.  Thus  agencies  provide  the  data 
processing  demand  .and  CSD  is  required  under  current  statutes  to 
process  the  work. 

When  agencies  add  applications  to  the  central  computer  system, 
they  increase  CSD's  workload.  Up  to  now  most  agency  developed 
applications  have  been  small,  and  CSD's  reserve  capacity  has  been 
able  to  accommodate  the  request  for  additional  resources  with 
minimal  difficulties.  Most  of  the  large  applications  were  designed 
by  the  Systems  Development  Bureau  (formerly  Information  Systems 
Division)  which  had  a  policy  of  notifying  CSD.  However,  agencies 
are  beginning  to  design  larger  applications,  especially  those  requir- 
ing substantial  processing  during  the  daytime  or  substantial  storage. 
These    applications    could   place  a   strain  on   CSD's   resources.      Other 
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CSD  users  could  suffer  processing  inconveniences  and  CSD  may 
have  to  acquire  equipment  with  less  planning,  and  possible  increas- 
ing costs. 

The  potential  problems  stem  from  the  fact  that  users  are  not 
required  to  give  CSD  advance  notice  of  the  addition  of  significant 
applications  to  the  system.  The  development  of  agency  plans 
should  help.  In  addition,  we  recommend  the  Department  of  Adminis- 
tration develop  policies  concerning  notification  of  new  applications 
to  CSD  which  are  not  contained  in  agency  plans.  The  policies 
should   include: 

--The    amount   of   time  in   advance  that  various   resource   requests 
should   be  made. 

--Minimum     resource     request     levels     below    which     notice    is    not 
required. 

--Periodic    updates    if   the    resource    requirements    change    signifi- 
cantly. 

--Formal   written   notification  of  resource   requests. 

RECOMMENDATION   tt6 

WE  RECOMMEND  THE  DEPARTMENT  OF  ADMINISTRATION 
DEVELOP  POLICIES  CONCERNING  NOTIFICATION  OF  COM- 
PUTER   RESOURCE    DEMANDS    FOR    NEW   APPLICATIONS. 

DATA   PROCESSING    REQUEST   JUSTIFICATIONS 
AND   ANALYSIS   OF    RESULTS 

Since    the    state     spends    about    $20    million    per    year    on    data 

processing,      we     believe     formalized      analysis     of     data     processing 

requests   is   an   important  management  task. 
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Review  of  data  processing  requests  is  performed  at  different 
levels.  Computer  program  development  by  in-house  staff  with 
current  budget  is  reviewed  by  agency  management.  If  the  agency 
intends  to  contract  for  the  development  using  current  budget,  the 
Department  of  Administration  must  review  it.  Equipment  purchases 
using  current  funds  are  reviewed  by  the  Department  of  Administra- 
tion. The  Office  of  Budget  and  Program  Planning  and  the  Legis- 
lature review  the  request,  if  an  appropriation  is  needed  for  develop- 
ment or  equipment. 

OBPP,     DofA,    and    the    Legislature   often    have    little   first-hand 
knowledge  of  the  activity  for  which   computer  programs  or  equipment 
is    being    requested.      Thus,    the   justification    and    supporting    docu- 
mentation    is    relied    upon    heavily    in    the    decision-making    process. 

We  examined  a  sample  of  budget  requests  and  a  sample  of 
equipment  requests  to  determine  the  adequacy  of  justification.  We 
found  weaknesses  in  the  justifications  for  budget  requests  and  for 
equipment  requests.  Since  the  review  processes  for  budget  requests 
and  for  equipment  requests  are  different,  we  discuss  each  separately. 
In  addition,  we  found  little  documented  analysis  of  the  results  of 
approved   budget  or   equipment   requests. 

Data   Processing   Budget   Request  Justification 

All  requests  for  additional  funds,  including  data  processing 
requests,  are  routed  through  the  Office  of  Budget  and  Program 
Planning  before  being  presented  to  the  Legislature.  In  the  case  of 
data  processing  requests,  the  budget  analyst  for  the  agency  and 
the  Deputy  Budget  Director  (formerly  the  Data  Processing  Coordi- 
nator)    evaluate    the    request    and    recommend    whether    the    request 
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should  be  included  in  the  Governor's  budget.  OBPP  did  not  com- 
ment on  requests  submitted  by  elected  officials  or  the  legislative 
and  judicial    branches. 

To  determine  the  adequacy  of  the  justifications,  we  reviewed 
a  sample  of  data  processing  budget  requests.  We  examined  docu- 
mentation in  OBPP  and  in  agency  files,  as  well  as  interviewing 
OBPP  and  agency  officials.  The  following  examples  illustrate  the 
weaknesses  found   in   most  requests. 

An  example  is  the  justification  for  automating  the  Board  of  Oil 
and  Gas  Conservation  records.  This  was  a  request  for  $85,000  in 
the  1981  Session.  An  additional  $145,000  request  was  made  during 
the  1983  Session  to  add  more  capability  than  originally  envisioned. 
The  original   justification   contains  the  following    language: 


".  .  .  This  information  is  currently  being  posted  and 
compiled  into  various  reports  manually  which  is  an  out  of 
date,  costly,  time  consuming  method  of  record  keeping 
for  the  volume  of  statistics  and  reports  compiled.  .  .  It 
would  provide  data  for  energy  and  reserve  calculations, 
provide  better  information  for  tax  calculations,  utilize 
personnel  computing  the  information  more  effectively, 
increase  accuracy  and  provide  information  for  other 
energy  related  government  entities.  The  division  also 
receives  considerable  requests  for  this  type  of  informa- 
tion from  industry,  research  organizations,  land  and 
mineral  owners,  and  other  individuals.  The  faster,  more 
accessible  data  retrieval  thru  an  electronic  data  process- 
ing system  would  allow  quicker,  more  complete  and 
accurate   response  to  these   requests.    .    ." 


This  justification  discusses  many  benefits  for  the  new  system, 
but  it  talks  in  generalities.  It  does  not  give  tangible,  quantifiable 
benefits   including: 
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■-The    amount   of   time    and    cost    to   compile   the    reports    manually 
versus   the  time  and   cost  to  use  a  computer  system. 

■-The   number   of   information    retrieval    requests   and   the   time  to 
process  them  manually  or  with  a  computer. 

■-How  many  fewer  errors  there  will   be  with   an   automated   system 
rather  than  a  manual  one. 


Justifications  not  reviewed  by  OBPP  had  similar  flaws.  The 
Public  Service  Commission  requested  four  FTE  and  over  $500,000 
for  the  1983-85  biennum  with   this  justification: 


"As  noted  in  its  recent  sunset  audit,  the  Commission  has 
no  computer  capability  to  assist  in  the  regulation  of 
Montana's  largest  industries.  It  seeks  funds  to  hire  two 
systems  analysts  and  two  programmers  associated  with 
the  development  and  operation  of  computer  systems. 
This  modification  would  provide  the  Commission  with  this 
much  needed  tool,  expanding  the  analytical  capabilities  of 
the  office  and  assist  in  the  timely  and  efficient  process- 
ing of  rate  cases." 


This   justification    is   inadequate   in   several    respects,    including: 

-The  justification  states  that  the  data  processing  will  allow 
them  to  process  cases  faster.  However,  it  does  not  describe 
how  much  faster.  Will  it  save  a  week  or  two  months  in  a 
year   long   case? 

-The  justification  also  does  not  describe  the  volume  of  data 
which  is  currently  processed  and  the  volume  which  could  be 
processed    if  the   PSC   had   data   processing. 

-The  request  does  not  describe  the  costs  or  benefits  of  provid- 
ing the  information  nor  if  the  industry  data  is  to  be  provided 
in  machine  readable  form,  whether  there  are  potential  machine 
compatibility   problems. 


Our  overall  analysis  indicates  current  justifications  for  data 
processing  requests  are  often  inadequate  in  three  respects.  These 
include: 
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--Failure    to    list    all    of    the    costs    and    benefits   of   the    request. 

--Failure  to  quantify  costs  and  benefits.  (Quantification  does 
not  always  mean  dollars.  A  valid  quantification  could  be  to 
increase  the  number  of  transactions  processed  per  hour  from 
10  to  50.) 

--Failure  to  document  the  analysis  performed  to  arrive  at  the 
justification. 


Without  adequate  initial  quantification  of  costs  and  benefits, 
agency  officials  have  a  difficult  time  managing  projects  or  equip- 
ment items  because  they  have  little  tangible  information  on  what  is 
supposed   to  be  accomplished. 

The  poor  documentation  makes  it  difficult  for  OBPP  and 
agency  officials  to  support  their  actions.  Our  observations  indicate 
that  these  weaknesses  in  justification  make  approval  by  the  Legisla- 
ture more  difficult.  For  example,  a  request  by  the  Department  of 
State  Lands  for  data  processing  was  initially  disapproved.  Later, 
part  of  the  funding  was  approved  after  the  department  provided 
additional  justification.  Even  the  second  justification  was  weak  in 
quantification  which   may   have   led   to  only   partial   approval. 

Current  justifications  make  it  difficult  for  the  Legislature  and 
its  staff  to  fulfill  their  oversight  role.  They  are  left  without 
adequate  criteria  to  which  to  compare  actual    performance. 

OBPP  has  responsibility  for  the  budget  process,  including  the 
adequacy  of  budget  request  justifications.  Therefore,  we  recom- 
mend OBPP  adopt  standards  for  justification  of  data  processing 
budget  requests.  The  standards  could  be  used  by  the  elected 
officials  and  the  legislative  and  judicial  branches  to  improve  their 
requests.  OBPP  may  wish  to  have  DofA  conduct  a  technical  review 
of    the    requests    since    DofA    will    be    preparing    the    statewide    data 

processing   plan. 
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Data   Processinc)    Equipment   Requests  Justification 

The  state  spends  several  million  dollars  each  year  on  the 
acquisition  of  data  processing  equipment.  The  Legislature  has 
provided  for  a  central  review  of  these  equipment  requests.  Part 
of  our  review  included  an  evaluation  of  this  central  review  process. 
To  do  so,  we  reviewed  a  sample  of  equipment  requests  for  adequacy 
of  justification  and  supporting  documentation.  The  following  are 
two  examples  of  the  justifications  submitted. 

In  September  1982  Eastern  Montana  College  justified  the 
acquisition  of  a  $35,000  word  processing  system  with  general 
statements  about  improving  productivity,  producing  individualized 
acknowledgments  to  a  large  and  increasing  volume  of  requests,  and 
reducing  the  need  for  complete  retyping  of  material.  The  justifica- 
tion  does   not   include: 


--a    description    of    the    volume    of    typing    being    done,    possible 
staff  reductions  or   reassignments  to  other  activities. 

--The  costs  to  train   staff  to  use  the  new  machinery. 

A  similar  request  for  $9,000  to  add  to  word  processing/data 
processing  equipment  configuration  at  the  Department  of  Health 
and    Environmental    Sciences    in    October    1982   had    this   justification. 

"This  workstation  will  be  connected  to  existing  IBM 
Displaywriter  and  printer.  This  unit  will  allow  Manage- 
ment Services  Bureau  to  process  increasing  numbers  of 
cash  receipts  in  a  timely  manner.  Two  workstations  will 
reduce  input  and  output  time  by  at  least  50  percent  to 
70  percent.  .  .  This  piece  of  equipment  will  allow  us  to 
start  RJEing  our  accounting  data  to  Department  of  Admin- 
istration,   Accounting    Division.    .    ." 
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This   justification    does    not    include   pertinent  information,    sucin 
as: 


--The    number    of    cash     receipts    and     other    transactions    being 
processed. 

--What    timely    manner    means.       Does    it    mean    10  minutes    instead 
of  an   hour  or  55  minutes   rather  than   an   hour? 

--What  benefit  the   reduction   in   input  and  output  time  will   mean. 

--What  benefits  are  associated   with  directly  transferring   account- 
ing  data. 


As  with  the  data  processing  budget  requests,  the  equipment 
requests  usually  do  not  list  all  costs  and  benefits,  do  not  quantify 
costs  and  benefits,  and  do  not  document  the  analysis  used  to 
arrive  at  the  justification.  Also,  the  poor  documentation  makes 
review  by  management  and  the   Legislature  very  difficult. 

Neither  the  Office  of  Budget  and    Program   Planning    (when   this 
was     their     responsibility)     nor     the     Department     of    Administration 
(which    currently    has    the    duty)    has    issued    specific    guidelines    to 
agencies     concerning     what     is     an     adequately     justified     equipment 
request.      We  believe  such   guidance  would   help  the  agencies   improve 
their  justifications.      Therefore,    we   recommend    DofA  adopt  standards 
for  justification  of  data   processing   equipment   requests. 
Analysis  of  Project  Results 

Currently,  state  agencies  do  not  routinely  analyze  the  actual 
results  of  a  data  processing  project  against  the  planned  results. 
The  state  is  spending  several  million  dollars  each  year  on  software 
development  and  equipment  acquisition  without  reviewing  whether 
the    item    acquired    or    software    developed    is   performing   as   planned. 
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Such    analysis    could    yield    some    valuable    information    for    manage- 
ment,   including: 


-Whether  equipment  is  performing  as  expected  and   if  corrective 
action   is   necessary. 

-Whether   the   original    intent  of  the  project  is   being  fulfilled   by 
the  end   product. 

-Whether  the  cost  and   benefit  projections  were  accurate  and,    if 
not,    assist    in    making   more  accurate  projections   in  the  future. 


The  information  on  planned  versus  actual  results  could  be 
used  to  evaluate  the  original  justifications.  The  Legislature  could 
determine  whether  past  appropriations  have  been  used  properly 
and  thus  what  future  appropriations  should  be  made.  Also,  DofA 
could   evaluate  its   review  of  equipment  acquisition    requests. 

In  future  EDP  audits  of  agencies,  we  will  review  planned  and 
actual  results.  This  information  will  be  used  in  evaluating  how 
well   an   agency   is  managing   its  data  processing  activities. 

Our  discussions  with  other  states  and   private  industry  indicate 
that  post-implementation   reviews  are  standard   procedure.      However, 
Montana     does     not     have     a     policy     requiring     post-implementation 
review. 

The  Department  of  Administration  is  responsible  for  establish- 
ing policies  for  the  development  of  data  processing  in  state  govern- 
ment and  for  reviewing  agency  specifications  and  procurement 
methods  for  acquisition  of  data  processing  equipment.  We  recom- 
mend the  Department  of  Administration  establish  a  policy  requiring 
agencies  to  analyze  planned  and  actual  results  of  significant  data 
processing  projects.  To  provide  consistency,  the  policy  should 
define  what   is   significant. 
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RECOIVIMENDATION   #7 
WE    RECOMMEND: 

A.  THE  OFFICE  OF  BUDGET  AND  PROGRAM  PLANNING 
ADOPT  STANDARDS  FOR  JUSTIFICATION  OF  DATA 
PROCESSING    BUDGET    REQUESTS. 

B.  THE  DEPARTMENT  OF  ADMINISTRATION  ADOPT  STAN- 
DARDS FOR  JUSTIFICATION  OF  DATA  PROCESSING 
EQUIPMENT    REQUESTS. 

C.  THE     DEPARTMENT    OF     ADMINISTRATION     ESTABLISH    A 
POLICY    REQUIRING    AGENCIES    TO    ANALYZE    THE    RESULTS 
OF    SIGNIFICANT    EQUIPMENT    ACQUISITIONS    AND    COM- 
PUTER   PROGRAM   DEVELOPMENT. 
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CHAPTER    V 
ADDITIONAL   MANAGEMENT    IMPROVEMENTS 

Besides  .    the      improvements      in      planning      and      policies,      we 
identified   two  areas   in   which   additional   improvement  in   data  process- 
ing   management   could    be   obtained.      The  following   sections  discuss 
our    suggestions    for    improvement   concerning    inventory  of  computer 
programs  and   data   processing   professional   staff  turnover. 
INVENTORY   OF   COMPUTER    PROGRAMS 

We  reviewed  computer  applications  throughout  state  government 
to  determine  if  agencies  are  developing  computer  programs  which 
are  similar  to  existing  computer  programs  used  by  other  agencies. 
We  found  little  duplication.  While  agencies  are  not  required  to 
review  for  similar  computer  programs  prior  to  beginning  develop- 
ment of  an  application,  these  reviews  are  being  performed,  largely 
because  of  the  cost  of  developing  new  applications.  Cost  of  develop- 
ment can  be  substantially  reduced  if  a  similar  application  exists 
that  can  be  modified  to  meet  an  agency's  needs.  A  recent  article 
estimated  that  as  much  as  80  percent  of  the  computer  code  needed 
for  a  computer  program  has  probably  already  been  developed  for 
another  program. 

We  believe  DofA  should  encourage  agencies  to  share  software 
as  a  way  of  saving  the  state  money.  The  two  biggest  hindrances 
to  sharing  of  software  are  the  uncertainty  about  the  quality  of 
software  and   the   lack  of  a  statewide  inventory  of  software. 

The     first     issue     should     become     less    of    a     problem     if    DofA 
develops  guidelines   for  computer  program  development  and   documen- 
tation.       This     should     provide     assurance     to     agencies     that     most 
computer  programs  will    be   readily   usable. 
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While  no  current  inventory  exists,  DofA  is  developing  an 
inventory  system.  Previous  efforts  at  developing  an  inventory 
failed  because  some  agencies  did  not  perceive  a  significant  direct 
benefit  from  participation.  We  recommend  DofA  encourage  agencies 
to  participate  by  educating  them  to  the  benefits  of  sharing  computer 
programs.  This  could  be  done  by  publicizing  examples  of  sharing 
that  have  worked.  A  prime  example  is  an  accounts  receivable 
system  used  by  both  the  University  of  Montana  and  Eastern  Montana 
College. 

RECOMMENDATION   #8 

WE  RECOMMEND  THE  DEPARTMENT  OF  ADMINISTRATION 
ENCOURAGE  AGENCIES  TO  PARTICIPATE  IN  A  COMPUTER 
PROGRAM    INVENTORY   AND   SHARING   PROGRAM. 

PROFESSIONAL   DATA    PROCESSING   STAFF   TURNOVER 

We  reviewed  data  processing  staff  turnover  in  Montana  and 
compared  it  to  turnover  in  other  states  and  private  industry.  For 
professional  data  processing  staff,  Montana's  turnover  was  about 
20  percent  for  1982  and  the  first  two  months  of  1983.  In  contrast, 
the  private  industry  goal  is  less  than  10  percent  turnover.  The 
five  firms  we  contacted  reported  less  than  5  percent  turnover  in 
their  professional   data   processing   staffs. 

If  turnover  is  excessive,  the  organization's  effectiveness 
decreases.  This  is  evidenced  by  increases  in  software  development 
costs  and  projects  which  are  not  completed  on  schedule.  The 
Department   of    Livestock    Brands    system    experienced    cost    overruns 
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and  delays  due,  at  least  in  part,  to  turnover.  Turnover  also 
increases  the  time  and  cost  associated  with  training.  When  an 
experienced  staff  persons  leaves,  an  agency  must  devote  substan- 
tial resources  to  bring  the  replacement  up  to  the  same  level  of 
competency.  A  recent  computer  journal  article  estimated  training  a 
new  staff  person  can  be  equivalent  to  three  time  an  employee's 
annual    salary. 

We  reviewed  the  reasons  for  data  processing  personnel  turn- 
over in  Montana.  Recent  computer  journal  articles  indicate  that 
compensation  and  training  are  usually  the  two  biggest  contributors 
to  turnover.  The  following  sections  discuss  salaries  and  training 
for  state  data  processing  professionals. 
Salaries 

Using  the  1982  state  employee  salary  and  benefit  survey  and 
a  private  industry  salary  survey,  we  compared  Montana's  salaries 
to  neighboring  states  and  private  industry.  The  following  illustra- 
tion shows  that  professional  data  processing  staff  in  Montana  are 
paid     less    than     in    the    private    sector    or    in    neighboring    states. 

SALARY  ConPAKlSON  FOH  PROFESSIONAL  DATA  PROCESSING  STAFF 


National    Percent  Difference  Percent  Difference    Neighboring   Percent  Differenc 

Monthly     Salary        Montana  vs  Montana       Montana  vs  Montana     States         Montana  vs 

Salary  *    Survey  '■    National   Survey    Employer  Survey*   Employer   Survey 


Computer  Programmer  I 

$1,^72 

$1,667 

(16.8) 

$1,498 

(4.8) 

$1,512 

(5.7) 

Computer  Programmer  II 

1,701 

1,908 

(12.2) 

1  ,988 

(14.5) 

1,755 

(3.1) 

Programmer  Analyst  11 

1,858 

2,233 

(20.2) 

1,989 

(6.6) 

2,218 

(16.3) 

Software  Specialist  II 

2,021 

2,642 

(30.1) 

N/A 

N/A 

2,373 

(26.2) 

*  Monthly  Average  or  Median  Salaries 

(   )  Percentage  in  Excess  of  Montana's  Salary 

Source:   Compiled  by  the  Office  of  the  Legislative  Auditor 


Illustration  2 
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We  believe  the  state's  salary  structure  for  data  processing 
professional  staff  contributes  to  turnover.  DofA  is  currently 
studying  the  state's  salary  system.  We  recommend  the  Department 
of  Administration  include  in  its  study  the  effects  of  the  current 
salary  structure  on  data  processing  professional  staff  turnover. 
Training 

From  our  contacts  with  private  industry,  we  found  the  average 
annual  training  for  data  processing  personnel  at  a  programmer 
level  and  above  is  about  three  weeks  per  person.  Discussions 
with  agency  officials  revealed  Montana's  state  data  processing 
personnel  do  not  receive  as  much  training  per  year  as  private 
firms  provide.  While  actual  data  is  not  readily  available,  our 
discussions  with  agency  officials  indicate  that  most  data  processing 
professional  staff  receive  about  one  week  per  year  with  a  few 
agencies  providing  as  much  as  two  weeks  per  year. 

We  estimate  increasing  training  of  professional  data  processing 
staff  from  one  week  to  two  weeks  per  year  could  cost  an  extra 
$100,000  to  $200,000  per  year.  We  believe  training  for  personnel 
is  important  in  order  for  staff  to  develop  expertise  and  promote 
efficiency.      Thus,   this  extra  expenditure  can   be  justified. 

Training  people  to  use  new  technologies,  such  as  some  of  the 
new  computer  program  development  tools,  can  increase  the  produc- 
tivity of  programmers.  Computer  programs  can  be  designed  at  a 
lower  cost  and  put  work  sooner.  Thus,  the  state  saves  money  in 
the  long  run  on  development  as  well  as  getting  more  computer 
programs  developed.  If  productivity  were  increased  five  percent, 
it  would   pay  for  most  of  the  training  costs. 
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To  improve  the  state's  situation  concerning  training,  we 
recommend  the  Department  of  Administration  encourage  agencies 
provide    more    training    for   their    professional    data    processing   staff. 

RECOMMENDATION  #9 

WE  RECOMMEND  THE  DEPARTMENT  OF  ADMINISTRATION: 

A.  INCLUDE  IN  ITS  SALARY  STUDY  THE  EFFECTS  OF  THE 
CURRENT  SALARY  STRUCTURE  ON  DATA  PROCESSING 
PROFESSIONAL  STAFF  TURNOVER. 

B.  ENCOURAGE  AGENCIES  TO  PROVIDE  MORE  TRAINING 
FOR  THEIR  PROFESSIONAL  DATA  PROCESSING  STAFF. 
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DEPARTMENT  OF  ADMINISTRATION 

DIRECTORS  OFFICE 


TED  SCH  WINDEN,  GOVERNOR 


MITCHELL  BUILDING 


STATE  OF  MONTANA' 


(406)449-2032 


HELENA.  MONTANA  59620 


September  12,  1983 


Robert  R.  Ringwood 
Legislative  Auditor 
State  Capitol,  Room  135 
Helena,  MT   59620 

Dear  Mr.  Ringwood: 

We  have  reviewed  the  recommendations  on  coordination  and  control  of 
State  data  processing.   In  light  of  the  fact  that  coordination  and 
control  responsibility  has  only  recently  been  given  to  this  department 
with  the  passage  of  HB427  last  legislative  session,  the  recommendations 
are  timely  and  will  surely  assist  us  in  assuming  our  new  role. 

Many  of  the  recommendations  are  focused  on  areas  that  we  have  already 
recognized  as  problems  but  haven't  really  had  time  to  take  appropriate 
action.   We  will  become  much  more  actively  involved  in  the  coordination 
of  State  data  processing  before  the  end  of  this  fiscal  year. 

Our  responses  to  each  of  the  recommendations  are  enclosed.   We 
appreciate  the  opportunity  we  have  had  to  interact  with  your  staff  on 
these  issues  and  also  the  opportunity  provided  to  us  at  this  time  to 
respond  formally  to  the  recommendations. 

Sincerely, 

Morris  Brusett,  Director 
Department  of  Administration 


Enclosure 
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AN  £QUAL  OppnRruNiry  employer  ■ 


Response  to  the  EDP  Audit  of 
COORDINATION  AND  CONTROL  OF  STATE  DATA  PROCESSING 


RECOMMENDATION  #1 

WE  RECOMMEND  THE  DEPARTMENT  OF  ADMINISTRATION  USE  ITS  AUTHORITY 
AND  TAKE  AN  ACTIVE  LEADERSHIP  ROLE  IN  COORDINATING  AND 
CONTROLLING  STATE  DATA  PROCESSING. 

D  OF  A  RESPONSE 

The  Department  of  Administration  began  its  active  role  before 
HB427  (which  transferred  control  responsibility  to  the  D  of  A) 
was  passed  by  the  last  legislature.   We  worked  with  the  budget 
office  to  draft  appropriate  wording  that  would  expand  the  scope 
of  coordination  and  control.   We  actively  supported  the  passage 
of  the  bill. 

Since  the  effective  date  of  HB427  we  have  established  the  State 
Data  Processing  Advisory  Council  comprised  of  Department 
Directors  and  their  equivalents  from  other  branches  of  state 
government.   The  first  Advisory  Council  meeting  is  planned  for 
early  October  to  address  our  proposal  for  a  Statewide  Data 
Processing  Planning  process. 

We  fully  intend  to  establish  and  maintain  an  active  role  in  the 
coordination  and  control  of  state  data  processing. 


RECOMMENDATION  tt2 

WE  RECOMMEND  THE  DEPARTMENT  OF  ADMINISTRATION: 

A.  ESTABLISH  A  POLICY  FOR  UPDATE  OF  THE  STATE  PLAN  ON  A   - 
BIENNIAL  BASIS. 

B.  REVIEW  ATTAINMENT  OF  GOALS  AND  OBJECTIVES  CONTAINED  IN 
THE  STATE  PLAN  ON  A  BIENNIAL  BASIS. 

D  OF  A  RESPONSE 

We  concur  with  both  parts  of  this  recommendation.   An  ongoing 
planning  process  will  be  established  to  comply  with  these  points 


RECOMMENDATION  #3 

WE  RECOMMEND  THE  DEPARTMENT  OF  ADMINISTRATION: 

A.    PREPARE  GUIDELINES  FOR  WHAT  CONSTITUTES  AN  ADEQUATE 
AGENCY  DATA  PROCESSING  PLAN. 
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B.  ESTABLISH  A  PROCESS  FOR  REVIEWING  AGENCY  DATA  PROCESSING 
PLANS  AND  FOR  PROVIDING  FEEDBACK  TO  AGENCY  MANAGEMENT. 

C.  ENCOURAGE  AGENCIES  TO  PERIODICALLY  EVALUATE  THE 
ATTAINMENT  OF  GOALS  AND  OBJECTIVES  CONTAINED  IN  AGENCY 
PLANS . 

D  OF  A  RESPONSE 

We  concur.   A  planning  process  and  accompanying  guidelines  are 
currently  being  drafted  to  comply  with  points  A  and  B.   Point  C 
will  be  addressed  as  a  continuing  requirement  of  future  agency 
plans . 

RECOMMENDATION  #4 

WE  RECOMMEND  THE  DEPARTMENT  OF  ADMINISTRATION  DEVELOP  GENERAL 
POLICIES  FOR  COMPUTER  PROGRAM  DEVELOPMENT. 

D  OF  A  RESPONSE 

We  agree  with  this  recommendation  because  it  says  develop 
"general"  policies.   We  do  not  feel  that  specific  policies  on 
program  development  will  work  any  better  than  a  specific 
methodology  for  program  development  which  has  already  been 
attempted. 

RECOMMENDATION  #5 

WE  RECOMMEND  THE  DEPARTMENT  OF  ADMINISTRATION  ESTABLISH  POLICIES 
FOR  DOCUMENTATION  OF  IN-HOUSE  DEVELOPED  OR  PURCHASED  COMPUTER 
PROGRAMS . 

D  OF  A  RESPONSE 

We  agree  that  general  policies  which  promote  adequate 
documentation  for  all  software  utilized  in  State  Government  will 
help  minimize  the  cost  of  software  maintenance. 

RECOMMENDATION  #6 

WE  RECOMMEND  THE  DEPARTMENT  OF  ADMINISTRATION  DEVELOP  POLICIES 
CONCERNING  NOTIFICATION  OF  COMPUTER  RESOURCE  DEMANDS  FOR  NEW 
APPLICATIONS. 

D  OF  A  RESPONSE 

We  concur  with  this  recommendation. 
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RECOMMENDATION  #7 
WE  RECOMMEND: 

A.  THE  OFFICE  OF  BUDGET  AND  PROGRAM  PLANNING  ADOPT 
STANDARDS  FOR  JUSTIFICATION  OF  DATA  PROCESSING  BUDGET 
REQUESTS. 

B.  THE  DEPARTMENT  OF  ADMINISTRATION  ADOPT  STANDARDS  FOR 
JUSTIFICATION  OF  DATA  PROCESSING  EQUIPMENT  REQUESTS. 

C.  THE  DEPARTMENT  OF  ADMINISTRATION  ESTABLISH  A  POLICY 
REQUIRING  AGENCIES  TO  ANALYZE  THE  RESULTS  OF  SIGNIFICANT 
EQUIPMENT  ACQUISITIONS  AND  COMPUTER  PROGRAM  DEVELOPMENT. 

D  OF  A  RESPONSE 

Recommendation  #7-A  reflects  a  need  for  improvement  in  the 
budgetary  process.   However,  Department  of  Administration 
involvement  could  provide  a  source  of  technical  expertise  and  a 
mechanism  for  obtaining  consistency  between  agency  plans  and 
budgetary  requests. 

We  concur  with  recommendations  7-B  and  7-C. 

RECOMMENDATION  #8 

WE  RECOMMEND  THE  DEPARTMENT  OF  ADMINISTRATION  ENCOURAGE  AGENCIES 
TO  PARTICIPATE  IN  A  COMPUTER  PROGRAM  INVENTORY  AND  SHARING 
PROGRAM . 

D  OF  A  RESPONSE 

We  are  currently  developing  an  inventory  system  which  will 
provide  a  means  for  agencies  to  identify  computer  programs  that 
are  suitable  for  sharing.   Also,  we  will  be  encouraging  agencies 
to  use  existing  software  in  lieu  of  developing  systems  from 
scratch  whenever  feasible. 

RECOMMENDATION  #9 

WE  RECOMMEND  THE  DEPARTMENT  OF  ADMINISTRATION: 

A.  INCLUDE  IN  ITS  SALARY  STUDY  THE  EFFECTS  OF  THE  CURRENT 
SALARY  STRUCTURE  ON  DATA  PROCESSING  PROFESSIONAL  STAFF 
TURNOVER . 

B.  ENCOURAGE  AGENCIES  TO  PROVIDE  MORE  TRAINING  FOR  THEIR 
PROFESSIONAL  DATA  PROCESSING  STAFF. 

D  OF  A  RESPONSE 

We  concur  with  these  recommendations. 
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OFFICE  OF  THE  GOVERNOR 

BUDGET  AND  PROGRAM  PLANNING 


TED  SCHWINDEN.  GOVERNOR 


STATE  OF  MONTANA' 


(406)449-3616 


CAPITOL  BUILDING 


HELENA  MONTANA  59620 


September  8,  1983 


RFOf^lVED 

SEP  9    1983 

MONTANA  LEGISLATIVE  AUDITOR 


Mr.  Robert  R.  Ringwood 

Legislative  Auditor 

Office  of  the  Legislative  Auditor 

Capitol  Building 

Helena,  Montana   59620 

Dear  Mr.  Ringwood: 

The  following  is  our  response  to  the  recommendation  contained  in  the 
audit  of  Coordination  and  Control  of  State  Data  Processing. 

Recommendation  #7: 

We  recommend  that  the  Office  of  Budget  and  Program  Planning  adopt  standards 
for  justification  of  data  processing  budget  requests. 

Response : 

We  review  and  evaluate  all  agency  budget  requests  for  equipment  and  agree 
with  this  recommendation  that  equipment  justifications  could  be  improved 
upon  during  the  next  budget  cycle.   In  addition,  we  intend  to  have  the 
Computer  Services  Division  conduct  technical  reviews  of  major  data  processing 
budget  requests. 


DAVES :K/1 


Respectfully, 


DAVID  M.  LEWIS 
Budget  Director 
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